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Abstract 

We study the problem of clock synchronization in highly dynamic networks, where commu- 

£_j . nication links can appear or disappear at any time. The nodes in the network are equipped with 

C/3 | hardware clocks, but the rate of the hardware clocks can vary arbitrarily within specific bounds, 

O . and the estimates that nodes can obtain about the clock values of other nodes are inherently 

inaccurate. Our goal in this setting is to output a logical clock at each node, such that the 

£NJ . logical clocks of any two nodes are not too far apart, and nodes that remain close to each other 

in the network for a long time are better synchronized than distant nodes. This property is 

\l . called gradient clock synchronization. 

Gradient clock synchronization has been widely studied in the static setting, where the 
p^ network topology does not change. We show that the asymptotically optimal bounds obtained 

for the static case also apply to our highly dynamic setting: if two nodes remain at distance d 
from each other for sufficiently long, it is possible to upper bound the difference between their 
clock values by 0(d\og(D/d)), where D is the diameter of the network. This is known to be 
optimal for static networks, and since a static network is a special case of a dynamic network, it 
is optimal for dynamic networks as well. Furthermore, we show that our algorithm has optimal 
stabilization time: when a path of length d appears between two nodes, the time required until 
the clock skew between the two nodes is reduced to 0(dlog(D/d)) is 0(D), which wc prove is 
optimal. 



1 Introduction 

A core algorithmic problem in distributed computing is to establish coordination among the partici- 
pants of a distributed system, which is often achieved through a common notion of time. Typically, 
every node in a network has its own local hardware clock, which can be used for this purpose; 
however, hardware clocks of different nodes run at slightly different rates, and the rates can change 
over time. This clock drift causes clocks to drift out of synch, requiring periodic communication 
to restore synchronization. However, communication is typically subject to delay, and although an 
upper bound on the delay may be known, specific message delays are unpredictable. Consequently, 
estimates for the current local time at other nodes are inherently inaccurate. 



A distributed clock synchronization algorithm computes logical clocks at every node, and the 
goal is to synchronize these clocks as tightly as possible. Traditionally, distributed clock synchro- 
nization algorithms focus on minimizing the clock skew between the logical clocks of any two nodes 
in the network. The clock skew between two clocks is simply the difference between the two clock 
values. The maximum clock skew that may occur in the worst case between any two nodes at any 
time is called the global skew of a clock synchronization algorithm. A well-known result states that 
no algorithm can guarantee a global skew better than £l(D), where D denotes the diameter of the 
network pQ. However, in many cases it is more important to tightly synchronize the logical clocks 
of nearby nodes in the network than it is to minimize the global skew. For example, if a time 
division multiple access (TDMA) protocol is used to coordinate access to a shared communication 
medium in a wireless sensor network, it suffices to synchronize the clocks of nodes that interfere with 
each other when transmitting. The problem of providing better guarantees on the synchronization 
quality between nodes that are closer is called gradient clock synchronization. The problem was 
introduced in a seminal paper by Fan and Lynch [5], where the authors show that a clock skew of 
il(logD/loglog.D) cannot be prevented between immediate neighbors in the network. The largest 
possible clock skew that may occur between the logical clocks of any two adjacent nodes at any time 
is called the local skew of a clock synchronization algorithm. For static networks, it has been proved 
that the best possible local skew that an algorithm can achieve is bounded by G(logL') [1 H 112] . 

While tight bounds have been shown for the static model, the dynamic case has not been as 
well understood. A dynamic network arises in many natural contexts: for example, when nodes are 
mobile, or when communication links are unreliable and may fail and recover. The dynamic network 
model we consider in this paper is general: it allows communication links to appear and disappear 
arbitrarily, subject only to a global connectivity constraint (which is required to synchronize all 
nodes to each other). Hence the model is suitable for modeling various types of dynamic networks 
which remain connected over time. 

In a dynamic network the distances between nodes change over time as communication links 
appear and disappear. Consequently, we divide the synchronization guarantee into two parts: a 
global skew guarantee bounds the skew between any two nodes in the network at any time, and 
a dynamic gradient skew guarantee that bounds the skew between two nodes as a function of the 
distance between them and how long they remain at that distance. 

In [8] , three of the authors showed that a clock synchronization algorithm cannot react immedi- 
ately to the formation of new links, and that a certain stabilization time is required before the clocks 
of newly- adjacent nodes can be brought into synch. The stabilization time is inversely related to 
the synchronization guarantee: the tighter the synchronization required in stable state, the longer 
the time to reach that state. Intuitively, this is because when strict synchronization guarantees are 
imposed, the algorithm cannot change clock values quickly without violating the guarantee, and 
hence it takes longer to react. The algorithm given in [8] achieved the optimal trade-off between 
skew bound and stabilization time; however, the local skew bound it achieved was 0(\^D), which 
is far from optimal. 

In this paper, we describe an anlgorithm that achieves the same asymptotically optimal skew 
bounds as in the static model: if two nodes remain at distance d for sufficiently long, the skew 
between them is reduced to O (dlog(D / d)) , where D is the dynamic diameter of the network 
(corresponding roughly to the time it takes for information to reach from one end of the network 
to the other). The stabilization time of the algorithm, that is, the time to reach this guarantee 
is O(D). We also improve the trade-off lower bound from [8] to show that a stabilization time of 



£l(D) is necessary for an algorithm with the C(dlog(D/(i))-gradient skew property. This shows 
that our algorithm is optimal in its stabilization time as well as its skew guarantee. In addition, 
in a conference version of this paper, we decribe a more elegant variant of our algorithm with a 
slightly worse stabilization time of O(DlogD) [7j. 

2 Related Work 

The fundamental problem of synchronizing clocks in distributed systems has been studied exten- 
sively and many results have been published for various models over the course of the last approx- 
imately 30 years (see, e.g, |X6|, [TBI fl9| I20j). Until recently, the main focus has been on bounding 
the clock skew that may occur between any two nodes in the network, and a tight bound of Q(D) 
has been proved [U OH [20] . 

The problem of synchronizing clocks of nodes that are close-by as accurately as possible has 
been introduced by Fan and Lynch [5]. In their work, the authors show that a clock skew of 
i7(logZ?/loglogD) between neighboring nodes cannot be avoided if the clock values must increase 
at a constant minimum progress rate. Subsequently, this result has been improved to Q(logD) j!2j . 
If we take the minimum clock rate a, the maximum clock rate /3, and the maximum clock drift rate p 
into account, the more general statement of the lower bound is that a clock skew of f2(log b D), where 
b := min{l/p, (/3 — a)/(ap)} cannot be avoided. The first algorithm guaranteeing a sublinear bound 
on the worst-case clock skew between neighbors achieves a bound of 0{\J pD) |13|. I14j . Recently, this 
result has been improved to C(log D) [TTJ (the base of the logarithm is a constant) and subsequently 
to 0(logfc D) [12]. Thus, tight bounds have been achieved for static networks in which neither nodes 
nor edges fail. 

The problem of synchronizing clocks in the presence of faults has also received considerable 
attention (see, e.g., [21 El [TOl [IS1 HT])- Some of the proposed algorithms are able to handle not only 
simple node or edges failures but also Byzantine behavior, which is outside the scope of this paper. 
However, while these algorithms can tolerate a broader range of failures, their network model is 
not fully dynamic as their results rely on the assumption that a large part of the network remains 
non-faulty and stable at all times. For the fully dynamic setting, it has been shown that there is 
an inherent trade-off between the clock skew S guaranteed between neighboring nodes that have 
been connected for a long time and the time it takes to guarantee a small clock skew over newly 
added edges. In particular, the time it takes to reduce the clock skew over new edges to 0{S) is 
Q,(D/S), where n denotes the number of nodes in the network [8j. In the same work, it is shown 
that for S G Q,(^pD), there is an algorithm that reduces the clock skew between any two nodes to 
0(S) in Q(D/S) time. In this paper, we show that S can be reduced to Q(log b D), i.e., the same 
optimal bound as for static networks can be achieved. 

3 Model and Definitions 

Clock synchronization. In the clock synchronization problem, each node u is equipped with 
a continuous hardware clock H u : M.^ — > M.q , which is initialized to H u (0) := 0. The hardware 
clocks do not necessarily progress at the rate of real time; they are subject to a (relative) clock 
drift bounded by p G (0, 1). At all times t we assume that -^H u (t) G [1 — p, 1 + p] for all nodes u. 
The objective of a clock synchronization algorithm (CSA) is to output a logical clock L u : Mq~ — > 
M.q (also initialized to L u (0) := 0), such that at all times, the logical clock values of different nodes 



are close to each other. Logical clocks must also have a bounded drift: there must exist constants 
a, (3 > such that 4iE u (t) G [a, /3] for all times t and for all nodes u. 

The estimate graph. In [9] two of the authors introduced an abstraction called the estimate 
layer, which simplifies reasoning about CSAs. Synchronization typically involves periodic exchanges 
of clock values between nodes, either through messages or by other means (e.g., RBS [1]). The 
estimate layer encapsulates all means by which nodes can estimate the clock values of other nodes, 
and eliminates the need to reason explicitly about delay bounds and other parameters of the system. 
The estimate layer provides an estimate graph, where each edge {u, v} represents the fact that 
node u has some means of estimating v J s current clock value and vice versa. The edges of the 
estimate graph are not necessarily direct communication links between nodes. Node u is provided 
with a local estimate V u of L v , whose accuracy is guaranteed by the estimate layer: 

Vt Vu € V, v € N u (t) : \L v (t) - L v u (t)\ < e {u , v} , (1) 

where £{ u ,v} is called the uncertainty, or the weight, of the edge {u,v}. Each edge is also associated 
with a propagation delay T{ UyV y that bounds the time needed to send a message from u to v and 
vice versa. In the sequel, we refer to estimate edges of the sort described above simply as edges; 
similarly, when we say "the graph" we mean the estimate graph. We do not reason explicitly about 
the communication graph, as the salient aspects of communication are encapsulated by the estimate 
layer. 

Dynamic networks. We consider dynamic networks over a fixed set of nodes V , where we denote 
n := \V\. Edge insertions and removals are modeled as discrete events controlled by a worst-case 
adversary. In keeping with the abstract representation from [9], we say that there is an estimate 
edge {u, v} between two nodes u, v G V at time t > iff u and v have a means of obtaining clock 
value estimates about each other at time t. As explained above, this does not necessarily mean 
that there is a direct communication link between u and v at time t. 

We assume that nodes do not necessarily detect link formations and failures immediately, or 
even at the same time as the other endpoint of the link. For each edge {u, v}, we assume that there 
is a parameter tt u >v \ such that both nodes u and v find out about the appearance or disappearance 
of edge {u, v} within Tt uv \ time units of the event itself. Hence, although we are interested in 
undirected networks, we model the estimate layer as a directed graph, where edge (u, v) exists 
whenever u thinks v is its neighbor. The appearance and disappearance of edges induces a dynamic 
graph G = (V,E), where E : IRq — > 2 maps non-negative times t > to a set of directed 

estimate edges that exist at time t. The graph is subject to the following constraints, which 
approximate symmetry up to the delay (rr niJ i) in finding out about link changes: (a) if for all 
t' G [t— T{ u ,i,},i+T{ Ui „}] we have (u,v) G E(t'), then (v,u) G E(t); (b) if for alii' G [t— T{ U)V y,t+T{ U}V y] 
we have (u,v) G" E(t'), then (v,u) G" E(t). Throughout each execution, every node u maintains a 
dynamic set of neighbors N u : IRq" — > 2 V , where N u (t) contains all nodes v such that (u,v) G E(t). 
In the sequel, we frequently refer to undirected edges {u, v}. When we write {u, v } G E(t) we mean 
that both (u,v) G E(t) and (v,u) G E(t). 

We say that edge {u, v} exists throughout a time interval [£1,^2] if for all t G [ii,^] we have 
{u, v} G E(t). By extension, a path p is said to exist throughout [£1,^2] if ah its edges exist 
throughout the interval. 



Definition 3.1 (Weighted Paths). Let G = (V,E) be a dynamic graph with edge weights e e , 
e G E(t). A path p = (uo, • • • , Uk) of length k > in G at time t is a tuple of nodes such that for 
all i & {1, . . . , k} it holds that {uj_i, Ui} € E(t). The weight of p is e p := Ylt=i e {u i ^ 1 ,u i }- 

We frequently refer to the skew on a path p = (uq, . . . ,Uk) at time t, by which we mean 

\L U0 (t) - L Uk (t)\. 

Dynamic diameter. A fundamental lower bound pQ shows that the performance of a CSA in a 
static network depends on the diameter of the network. In dynamic networks there is no immediate 
equivalent to a diameter. Informally, the diameter corresponds to the length of time it takes (at 
most) for information to spread from one end of the network to the other. To formalize this idea 
we adopt the following definitions. 

Definition 3.2 (Flooding). A flood that originates at node u is a process initiated when node u 
sends a Flood message to all its neighbors. Each node that receives the message for the first time 
forwards it immediately to all its neighbors. We say that the flood is complete when all nodes have 
received a Flood message. 

Definition 3.3 (Dynamic Diameter). We say that dynamic graph G has a dynamic diameter of 
D (or simply "diameter" for short) if a flood originating at any node in the graph at any time in 
the execution always completes in at most D time units. 

Clock skew. To measure the quality of a CSA we consider two kinds of requirements: a global 
skew constraint which gives a bound on the difference between any two logical clock values in the 
system, and a dynamic gradient skew constraint which becomes stronger the closer two nodes u, v 
are to each other and the longer u, v stay close to each other. In particular, for nodes that remain 
neighbors for a long time, the dynamic gradient skew constraint requires a much smaller skew than 
the global skew constraint. 

Definition 3.4 (Global Skew). A CSA guarantees a global skew of Q if at all times t, for any two 
nodes u,v G V, it holds that L u (t) — L v {t) < Q. 

In contrast, the dynamic gradient skew constraint does depend on the dynamic graph: the older 
the shortest path between u and v, the better synchronized u and v are required to be. 

Definition 3.5 (Dynamic Gradient Skew). Given a 

function S : Mq x M.q — y Rq that is non- decreasing in the first parameter (distance) and non- 
increasing in the second (time), we say that a CSA A guarantees a dynamic gradient skew of S 
if for all time intervals [ti,^] and each path p = (uo,...,Uk) that exists throughout the interval 
[ti,t2], we have that 

L U0 (t 2 ) - L Uk (t 2 ) < S(e p ,t 2 - h). 



If a CSA A guarantees a dynamic gradient skew of S, we say that it ensures a stable gradient skew 



ofS°°(d) := lim A t->oo S(d, At), where S°° 



If a CSA A guarantees a dynamic gradient skew of S, then we call A an "5-dynamic gradient 
CSA". The literature on gradient clock synchronization (e.g., [5l l8| fT2| 114]) is typically concerned 
with the local skew of a CSA, which bounds the skew on any single edge. The local skew can be 



considered equivalent to the stable gradient skew <S°°(1), provided that all edges are of uniform 
weight 1. 

We will further discuss the stabilization time of a CSA, which we define as follows. 

Definition 3.6 (Stabilization Time). Let A be a dynamic gradient CSA with a dynamic gradient 
skew of S. The stabilization time of A is defined as 

Ts ■= inf {At | VdVAt' > At : S(d, At') < 2S°°(d)} . 

The dynamic and stable gradient skew and the stabilization time are parametrized by D, the 
diameter of the network, and potentially other parameters such as the bound on the clock drift p 
or the minimum edge weight. Usually we omit these dependencies to simplify the notation. Note 
that the choice of 2 as the constant in the definition above is arbitrary; we are interested in the 
asymptotic behavior of the clock skew as D — > oo. 

4 A Class of Synchronization Algorithms 

Instead of providing a concrete algorithm, we define a class of algorithms, denoted by 21, and then 
proceed to show that each algorithm A that belongs to the class 21 guarantees (asymptotically) 
optimal skew bounds and integration times of new edges in Section [5j The advantage of this 
approach is that the focus is strictly on the essential properties of an algorithm and there are no 
details of implementation that distract from these properties. 

4.1 Conditions of 21 

To execute an algorithm A € 21, the nodes must maintain an upper bound Q on the global skew. 
We assume that all nodes have access to this bound. For a trivial bound Q, it is sufficient for all 
nodes to know the number n of nodes in the network, and use n as a conservative estimate for 
the diameter D of the graph in the global skew bound established in Section 15.11 If additional 
information is known about the network or if nodes run an additional protocol to estimate the 
dynamic diameter D of the network, the complexity of the algorithm can be improved by using a 
better bound Q. 

Additionally, the algorithm is provided a parameter p > 4/9/(1 — p) that defines the permitted 
relative speedup of the logical clock in comparison to the hardware clock. This parameter will be 
discussed in greater detail shortly. Furthermore, we assume that the algorithm knows (an upper 
bound on) p. Given these parameters, we define the value 

a := (1 - p)p/(4p) > 1 (2) 

whose purpose will be clarified in the analysis. Note that the requirement of a > 1 necessitates 
the lower bound on the parameter p given above. Lastly, we assume that the algorithm is aware 
of (upper bounds on) the values T{„ )V \ and £{ u , v } for any edge {u, v} that u believes to exist at a 
given time. 

The algorithm operates in loosely synchronized rounds r G N. In the following, we add the 
superscript (r) to variables that depend on the round number r. Round r locally starts and ends 
according to the logical clock values, i.e., two nodes might be in different rounds at the same time. 
The estimate Q^ r > that a node u £ V determines at time T± (when it enters round r) is used 

6 



to compute s max = SmaxW, the times T 2 , . . . ,7s max , and also the time T x when round r + 1 
starts. The duration of a round is r i (r+1) - T[ r) G 0{G^/fi). 

(r) (r) 

The logical times T 2 , • • • , 7s max serve the purpose of gradually incorporating new edges into 
the synchronization protocol without jeopardizing the gradient property on edges that already 
existed for a sufficiently long period of time. To this end, every node u stores sets N^ C N u 
for s G {1, . . . , Smix(u)}. An algorithm A G 21 must update each set JV® according to a specific 
subroutine that works as follows. 

At the beginning of the first round, all N^ are empty. At the beginning of each round r > 2, 

we have that N^ = N^ = ... = iV* max . At this time, after determining SmLx(u), the new sets 
A^ max +1 , . . . , A^ max are initialized to the same set (N^ = N% = . . .) of neighbors if SmLx{u) > 
Smax (u). Afterwards, for any newly appeared edge {u,v} the node v is added to N* and v is 
informed about this action. Each set N£, s G {2, . . . ,SmLx{u)}, is updated by setting it to A^ _1 

(r) 

whenever u's logical clock reaches a value T s , . A node f is removed from these sets in two cases, 
in both of which it is removed from all N^ at once: (i) node v is removed from N u , i.e., u believes 
that the edge {u, v} has failed, at any time in (its local) round r, or (ii) node u does not receive a 

1 (r) 

notification that v has added u to its set N^ until u's logical clock value reaches T 2 . The second 
case makes sure that we do not end up with "unidirectional" edges where only one of the nodes 
treats the edge as existent during round r, which again would risk violation of the gradient property 
on edges that have existed for a long time. 

Naturally, for our edge integration scheme to work properly, the estimate Q^ r > must satisfy 
certain properties. 

Condition 4.1. For all r G N we demand the following. 

• Any node u G V can access the value Q^~> at the latest at the time tu when T^ r = L M (tu ) 
and all nodes agree on that value, i.e., it does not depend on u. 

• Qy> > Q(t) for all t when L u (t) G [T± , T 2 r ') for some u G V, i.e., G^ r ' is a valid upper 
bound on the global skew for a sufficiently long time. 
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Q^> /((1 + aO/u) > max u£ y max ee g( iti ( r )){7^ + r e }, i.e., we exclude pathological cases where the 
time it takes to send even a single message over some edges is larger than the duration of the 
whole round. 

We will now discuss this procedure, which is summarized in Algorithm dj in greater detail. In 
each round, the following steps are carried out. At the beginning of the round, i.e., at time T"i, 
the upper bound Q on the global skew is updated whose new value has been computed during the 
course of the previous round using a separate mechanism. Then, the new s max is computed based 
on Q, /i, and p. Afterwards, the new times T^ < ■ ■ ■ < T Smax are computed (see Lines 9-13). The 
reason why the times T2, . . . ,T Smax form a geometric progression will become clear in Section [5j 
Subsequently, the new T±, i.e., the time when the subsequent round will start, is determined and 
T is set to {Ti,...,^}. 

During each round, only new neighbors that are in N u at the beginning of the round are 
added to the sets N^ , . . . , A"^ max , i.e., new neighbors that appear after T\ are ignored until the 
next round starts. Thus, at time T\ new neighbors are identified and stored in a set N new (see 
Line 18). A new neighbor v is only accepted permanently if v also accepts uasa neighbor in 



Algorithm 1 The logical clock value of node u reaches T s G T for some s G {1, . . . , s max }. 
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T:=T\{T S }; 
if T = {} then 

r := r + 1; // next round, as T\ is always the largest time in T 

Q := updateGlobalSkew(); 

Smax := min{s G N | W G N u : 2Q/a s ~ 2 < k {u<v} }; 

for s = 2, . . . , s max do 
N s ■= N 1 - 

end for 

T 2 := L u + g + (1 + p)0/p; 

T 3 := T 2 + (|i±g + ^i^£) g ; 

for s = 4, . . . , s max do 

T —T ,4- (*(1±E) _l (2+(6s+2) M )( CT +l) ^ A 

i s •- J s -i + ^(i_ P ) M(T s-4 h 7T^^ ) y, 

end for 

^1 == ^3 + ^ (g±g + (2+(65+ y (g+1) ) g + ft //setlf +1 > 

-^ := l-'lj ■ • ■ ) -'smaxJ i 

end if 

if s = 1 then 

N new :=N u \N^; 
N* :=Ku N new ; 
else if s = 2 then 

iV„ := iVy \{u G iV net0 | (neighbor_removed,t>,r) or no (new_neighbor,w,r) message received } 



:2 . 

else 



N z ■= N 1 



end if 



N s ■= N s 



the same round. In order to guarantee this, u sends a (new_neighbor, u,r) message. From the 
second and third property required of Q we know that at local time T 2 node u will have received a 
(new_neighbor,i>,r) message from v exactly if v added u to iVj at the time when round r started at 
v\}j This strategy is however not sufficient to guarantee consistency of neighbors' decisions. If an 
edge {u, v} fails after a (new_neighbor,v,r) message was sent by v, but the edge reappears before 
u reaches round r and the message is still delivered, u might believe that v added u to N£ after 
the edge reappeared, and therefore adds it as well. In order to identify this situation, node v also 
sends a (neighbor_removed,u,r) message whenever v believes that the edge reappears after it failed 
in round r. 

Having sorted this out, each new neighbor is added to N 2 at time T 2 (see Line 22), provided 
that u received (i) a (new_neighbor,u,r) message and (ii) no (neighbor .removed, t> ,r). Any other 
set N£, s G {3, . . . , s max }, is updated by simply setting it to A^ _1 at time T s (see Line 24). 

Since merely new neighbors that have been present at the beginning of the round are added, 
it is possible that some set N£ does not contain nodes in N u for more than one round. On the 
contrary, as mentioned before, whenever u detects that an edge {u, v} has disappeared, node v is 



1 Note that it is possible that a node u receives a (new_neighbor,w,r) message before it starts round r. 



removed from all sets N^ immediately. Thus, it is possible that when N^ is set to N^ 1 at time T s , 
the set A^ _1 may have changed since time T s _i; however, it always holds that N^ C A"*" 1 C N u 
for all s G {2, ... ,s max }. 

While the sets N^ and the corresponding update times are clearly defined, an algorithm has 
more freedom when it comes to determining the progress rate of its logical clock. As stated in the 
previous section, an algorithm must ensure that the logical clock value increases continuously. An 
algorithm A that belongs to the class 21 imposes a somewhat stronger constraint on the logical clock 
rate that depends on the parameter p > p/(l — p): The logical clock rate must always be at least 
the progress rate of the hardware clock, but at most a factor of 1 + /i larger. In other words, the 
logical clock rate is the hardware clock rate times a clock rate multiplier r v , where r v (t) G [1, 1 + p] 
at any time t. Moreover, an algorithm is forced to set its clock rate multiplier to 1 or to 1 + ^ 
under certain circumstances. These additional conditions depend on a parameter K{ Uj „), which is 
defined for each v G N u . For all v £ A^, it must hold that 

K{u,v} > ^{u,v} + 8^T{u,v}- (3) 

We further demand that ks U:V \ = k/ S]M }, which is easy to accomplish if the uncertainty of the 
estimates is assumed to be the same in both directions and the two nodes use the same parameterso 
Given these parameters, we can now state the conditions that restrict the clock rate multiplier. 

The fast and slow conditions. The fast mode condition determines when an algorithm must 
set the clock rate multiplier to 1 + p. 

Definition 4.1 (Fast Mode Condition). Given a graph G = (V,E) and K e for all e G E, an 
algorithm satisfies the fast mode condition if and only if for all s£N, for all u G V , and all times 
t it holds that 

Fr . 3w € N*(t) : L w (t) - L u {t) > sk {u>w} 1 .. _ 

Vv € Nffl : L u (t) - L v (t) < sk {u , v} + 2pr {U)V} ] ^ ™ + ^ 

The so-called slow mode condition specifies when the clock rate multiplier must be 1. 

Definition 4.2 (Slow Mode Condition). Given a graph G = (V,E) and n e for all e G E, an 
algorithm satisfies the slow mode condition if and only if for all s G N, for all u G V , and all times 
t it holds that 

Vv G N s a {t) : L v (t) - L u (t) < (s + \) K {u>v} +5 \. rM = , 
3we N°(t) : L u {t) - L w (t) > (s + |) k {u>w} - 5 J u{) ' 

where 5 > is an arbitrarily small constant. 

Max estimates. As in [8], I12 |, [T3], I14J . each node maintains a local estimate M u of the maximum 
logical clock value in the network, and makes sure never to exceed it. As this is a standard tech- 
nique we omit the implementation details, and note only that max estimates satisfy the following 



2 Otherwise, u and v could establish a common i^{ u ,v} by exchanging £{„,„} and £{„,„} and compute K,{ U}V y based 
on the larger of the two values. 



constraint: if the dynamic graph has a diameter of D, then for all t > and for all nodes u we have 

Af„(<)< max {£„(*)}, (4) 

vGV 

Vt > 2D : M u (t) > max {L v (t -2D)}, (5) 

M u (t) > L u {t), (6) 

M u (t)> max {^(t)-e {U)U} }, (7) 

That is, the max estimate of any node is never more than the true maximum, and it represents the 
true maximum from 2D time units ago, where D is the time required to complete a flood in the 
dynamic graph. (The factor 2 arises from the fact that nodes do not constantly flood the network 
with max estimates. It can be reduced to (1 + t), where l is an arbitrarily small constant, by 
starting floods sufficiently often.) In addition, ([6]) asserts that nodes cannot set their logical clock 
ahead of their max estimate, and ([7]) asserts that the max estimate always reflects the logical clock 
values of immediate neighbors. The max estimate M u {t) of a node is only used to determine the 
clock rate multiplier r u (t) if neither FC nor SC are satisfied. In this case, if L u {t) = M u (t) and for 
all neighbors v , L v (t) < L u (t), it must hold r u (t) = 1. Further, if L u = M u {t) and for all neighbors 
v, L v {t) > L u (t), it must hold r u = 1 + fi. 

These are all the conditions that an algorithm A E 21 must satisfy. We will now show that such 
an algorithm can be implemented. 

4.2 Implementation of an Algorithm A E 21 

It is clear that an algorithm A can maintain sets iV„, . . . , iV^ max and update them at the correct 
times by running Algorithm [TJ The conditions given by the max estimates M u (t) can easily be 
satisfied by using the estimate layer. We have to show that an algorithm can implement rules 
guaranteeing that FC and SC are always satisfied. 

The following rule, called the fast mode rule, ensures that FC holds. 

Definition 4.3 (Fast Mode Rule). An algorithm implements the fast mode rule if and only if for 
all s£N, for all u S V, and all times t it holds that 

3w £ N°(t) : L™{t) - L u (t) > sk {uM - e {uM 1 (t) = l + u 

Vv E N°(t) : L u (t) - Ll{t) < sk {uM + e {u , v} + 2»t {uM ) u{ ' " 

The corresponding rule for SC, the slow mode rule, is defined as follows. 

Definition 4.4 (Slow Mode Rule). An algorithm implements the slow mode rule if and only if for 
all s £ N, for all u E V , and all times t it holds that 

Vv E JV»(t) : Ll(t) - L u {t) <{s + \) k {uM + 5 {uM + e {uM 1 

3w E JV»(t) : L u (t) - L™(t) > (s + |) k {uM - 5 {u , w} - e {uM J " uU " 

where 5 e E (0, (n e — 4e e — 4^r e )/6] for all e = {u, v}, v E N^(t). 

The following lemma states that implementing these rules indeed guarantee that FC and SC 
are satisfied. 
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Lemma 4.2. If an algorithm implements the fast and the slow mode rule, it satisfies the fast and 
the slow mode condition, respectively. 

Proof. Assume that the precondition of FC holds for some s G N, i.e., for all t we have that 

3w G K(t) : L w (t) - L u {t) > sk {uM 

\/v G N*(t) : L u (t) - L v (t) < sk {u ^ v] + 2^T {UyV} . 

Since L w (t) < L™(t) + es UjW y for all w G N^(t), we immediately get that 
3w G Ntft) : (l™(t) + e {uM ) - L u (t) > sk {uM 
Vw G N°(t) : L u {t) - [L v u (t) + £{„,„}) < sk {u ^ v} + 2/j,T {UtV} . 



As the algorithm implements the fast mode rule, it must hold that r u (t) = 1 + /i as desired. 

Now, define 5 := min eg £{<5 e } > and assume that the precondition of SC holds for some s G N, 
i.e., for all t we have that 

Vv G N£(t) : L v (t) - L u (t) <( s + ]A K{u>v} + 5 
3w G K{t) : L u {t) - L w (t) > (s + -J k {u>w} - 5. 
We can now use that L w (t) > L™(t) — e^ uw y for all w G N£(t) to see that 

Vv G N°(t) : (L$(t) - e w , } ) - L u (t) < (s + M K {u>v} + S < ( s + i J rc {U)U} + <5 { „ M 

3w£ iV*(t) : L M (i)- (l#(t) -£{«,„,}) > (s + -J «{ UjW } - <5 > f s + — J «{ u>t0 } -*{u,w}- 

In this case, the assumption that the algorithm implements the slow mode rule implies that r u {t) = 
1. □ 

It remains to show that the clock rate multiplier is always well-defined, i.e., the two rules never 
cause a conflict. 

Lemma 4.3. If n e > 4e e + 4/ir e for all e G E, the fast mode rule and the slow mode rule are 
mutually exclusive. 

Proof. Assume that at node u at time t the prerequisites of the fast mode rule are met for some 
s G N, and the prerequisites of the slow mode rule are met for s' G N. We will first assume that 
s < s' , which implies that JV® C N^. In this case, according to the slow mode rule, there is a node 
w G N^ (t) such that 

L u (t) - L™(t) > ( s' + - j R{ Uitu } - £{ UiU ,} - €{ u>w y. 

However, we know that w G N£(t) because iV* (t) C N^(t). Hence, according to the prerequisites 
of the fast mode rule, we know that 

L u (t) - L™(t) <sk + e {UtW} + 2fiT {u ^ w} . 
11 



It follows that 

s + ^ I K {u,w} ~ 0{u,uj} — £{u,w} S SK-\- €{u iW } + 2/iT| UUI } 

implying that k {u>w} < 4e {u ^ } + 4^r + 25 {ltjW} . Since < 5 {u>w} < (k {u , w} - 4e {u<w} - 4/ir {Ujlu} )/6, 
we get the contradiction that 4e{ Uj ^} + ifiTs UiW \ + 25{ u „,} < K{ UtW y. 

Assume now that s > s' + 1, implying that N£(t) C A 7 ^ (t). The prerequisites of the fast mode 
rule say that there is a node u> G A^(i) such that 

L„(t) - -L^(i) > sk{ u ,^} - £{ u ,u.}- 

Since N^(t) C A 7 "* (£), we know that u; € A 7 "* (£). The prerequisites of the slow mode rule imply 
that 

L u (t) - L™(t) < ( s' + - J K{ Uitu } + 5{ UiU) } + e{ UU) }. 
In this case, it holds that 

(S + 1] K{ uw j — €{„„,} < SK| UjU } — e| u/u) | < ( S +- I H{u,w} + 0{ U)U ,} + £{«,«,}• 

Hence, we have that k {UjW} < 4e {u>w} +26 {u>w} . By using that 5 {u ^ w} < (K {u ^ w} -4e {UjW} -A^T {u <w} )/6, 
we get that 4:€^ uw y + 25^ uw y < K{ UjW }, again a contradiction. □ 

Assuming that n e > 4e e + 4//r e for all e £ E, Lemma 14.21 states that adhering to the fast mode 
and the slow mode rule implies that both the fast mode condition and the slow mode condition are 
met, while Lemma 14.31 proves that there is never a conflict between the two rules. Note that these 
two results together imply that the fast and the slow mode condition are also mutually exclusive. 
We will now analyze the properties of the class 21. 

As discussed in Section [3l nodes u and v are not necessarily informed that the edge {u, v} 
appeared or disappeared at the same time. However, it is possible to characterize for which times 
v G N£ implies that u G N£ as the following lemma shows. 

Lemma 4.4. Assume that v G N^(t\) for some s £ N, s / 1, and a time t\, and choose r G N 
such that Ts < L u {ti) < T s . For all s' G {l,...,s}, let t^ and if, denote the times when 
L u (t s u ) = T s , and L v (t s v ) = T s , , respectively. It holds that v G N^ (t) for all times t G [£* ,t\] and 
u G Ny (t) for all times t G [t^ , t\ — T{ Mjl) }] . 

Proof. We know that v is not removed from N u at any time in the interval [£* , £i], i.e., (u, v) G E(t) 
for all t G [t„,ti]. Otherwise we would have that v ^ N*(t\) because, according to Algorithm [TJ 
a removed neighbor cannot be added to N* again until the time t when L u (t) = Tg , which is 
larger than t\. Consider any s' for which t s u < t\. For each such s' we know that v is added to 
N£ at time i® unless v has already been in N£ before the round started. In either case, since v 
is continuously considered a neighbor until time t\ > £* , it follows that v G N£ (t) for all times 
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We will now prove the second claim. First, assume that u ^ N^(t^), implying that u £ N v (ty). 
Thus, node u cannot have received a (new_neighbor,u,r) message from v, which is a contradiction 
as it would have removed v from N^ at logical time T 2 < T s , i.e., before time t\. 

If (v, u) G E(t) at all times t G [ij,£i — ti UjV \], the claim is obviously true unless v did not 
receive a (new .neighbor, u,r) message until time t^. According to the second and third assumption 
on Q^ r \ we have that 

Lv(tl + T {u , v} ) < L v {tl) + (1 + p){\ + /i)T {UtV} 

< L u (tl) + g(ti) + (i + p )(i + fj)T {UiV} 

< r^ + gw + (1 + p) ^ ( 



A* 



— ^2 — ^v{t v ) 



i.e., indeed v received the (new_neighbor, u,r) message from u in time, added u to the sets N$ at 
the times t% , and did not remove it again until time t\ — ti UjV \ . 

Therefore, we assume that the edge {u, v} failed from the perspective of v at a time t G 
[tl,ti — ti uv \], i.e., (v,u) G" E(t) and {u, v) G" E(t') for some time t' G [t — Ti U)V \,t\. In this case, u 
registered that {u, v} failed at the latest at time t\ and removed v from all neighborhood sets N^ . 
Thus, as already observed, if the edge failed at time t', it must hold that t' < t\ because (u, v) exists 
throughout the interval [£*, t{\. On the other hand, as we know that (u,v) is in the edge set during 
[£* , ii], we also have that (v, u) G E(t) at times t G [tu + T{ u>v },ti — tt UjV \], Therefore, at the latest at 
time t^+Ti u>v \ (when it notices the reappearance of the edge), v will send a (neighbor_removed,t> ,r) 
message to u that is successfully delivered not later than at time t\ + ti UjV \ + T{ U)V y . According to 
the third assumption on Q^ r \ we have that 

L u (tl + T {u>v} ) < L u (ti) + (1 + p )(l + v)(t {uM + T {u>v} ) < T[ r) + (1 + P)gr < T 2 (r) = L u (t 2 u ). 

A* 

Therefore, we get the contradiction that u did not add v to iV„ at time t^ (instead, v is removed 
also from N^), which completes the proof. D 

The claimed bounds on the clock skew and the stabilization time are proved in the subsequent 
section. 

5 Analysis 

In this section, we analyze the algorithm described in Section U and bound its worst-case global 
and dynamic gradient skew. 

5.1 The Global Skew 

Like its predecessors in Q2] , Algorithm „4 DW achieves an asymptotically optimal global skew of 
0(D), where D is now defined as the dynamic diameter of the graph (see Section [3]). 

Theorem 5.1. Algorithm „4 DW achieves a global skew of 2(1+ p)D G O(D) in networks of diameter 
D. 
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Proof. The proof is similar to the ones in [8j [12]. First, consider the node u with the largest 
clock in the network, i.e., L u (t) = m&x V £y {L v (t)}. From §%§ and ([6]) we have M u (t) = L u (t), 
that is, node u knows that it has the largest clock value. In addition, by ([3]) and ([7|) we have 
M u (t) > max veNu{t) {L v (t) - e {Ujl ,}} and for any neighbor v, (1 - A)<(i) > (1 - A)«^„j > e {ll)V} . 
Hence, u's estimates of its neighbors' clock values cannot be large enough for FC to hold. Together 
with the fact that L u (t) = M u (t), this forces u to be in slow mode. 

For this reason, the maximum clock value in the network increases at most at rate 1 + p, 
the maximum hardware clock rate. From ([5]) it follows that for any node v we have M v (t) > 
maxtugy {L w (t)} — 2(1 + p)D; that is, the max estimates of all nodes are "not too far off" the true 
maximum. 

Now consider a node u with the smallest clock in the network, L u (t) = min^gy {L„(i)}, and 
suppose that L u (t) = max^y {L v {t)} — 2D(l + p), in other words, that there is a large gap between 
the smallest and largest clocks. Because M v (t) > max^gy {L w (t)} — 2(1 + p)D, we immediately 
obtain L u (t) < M u (t), so node u knows it is behind. In addition, since node u has the smallest clock, 
for each v G N u (t) we have L v (t) > L u (t), and hence L^(t) > L u (t) — er UjV y > L u (t) — (1/2 — A)k„(£), 
which means that SC does not hold (all of it's neighbors are too far ahead). Together with the fact 
that L u (t) < M u (t), this forces node u to be in fast mode. 

We have shown that whenever there is a large enough skew such that min„gy {L v (t)} = 
max„ e y {L v (t)} — 2(1 + p)D, all nodes with the smallest logical clock value, min„ e y {L v (t)}, will 
be in fast mode, and all nodes with the largest logical clock value will be in slow mode. A node in 
fast mode increases its logical clock at a rate of at least (1 + p)(l — p), and a node in slow mode 
increases its logical clock at a rate of at most (1 + p). Because p > p/(l — p), (1 + /i)(l — p) > 1 + p, 
so the nodes that are the most behind cannot fall behind any further. The continuity of logical 
clocks thus ensures that the global skew never exceeds 2(1 + p)D. □ 

As explained in Section [4~T| we assume that each node maintains an upper bound Q on the global 
skew of the network. This can be done dynamically, by running an estimation protocol alongside 
the clock synchronization algorithm, or the bound Q can be computed statically based on known 
properties of the network. For simplicity, we use a single global skew estimate Q throughout the 
paper. All algorithms and proofs can however be adapted to a scenario where each node maintains 
an individual and possibly dynamic upper bound on the global skew. 

5.2 Analysis of the Gradient Skew 

The gradient property that we will show depends on a certain gradient sequence. A gradient 
sequence is defined as follows. 

Definition 5.1 (Gradient Sequences). A non-increasing sequence of positive values C = {C s } s g^ 
is a gradient sequence at time t, if C\ > 2Q(t). 

Throughout our analysis, we will assume that the condition C\ > 2Q(t) holds at all considered 
times. We will discuss this time-dependent condition separately in Corollary 15.111 Moreover, we 
assume that s max (w) = oo for all nodes u £ V. We will see later, in Corollary 15. 121 that there is no 
need for the algorithm to implement the fast and slow mode rules on any level higher than Smax(w) 
at logical times in the interval [T^ r ,T^ r ) for any r G N. We will also make frequent use of the 
following definitions. 



14 



Definition 5.2 (Level-s Paths). Given the gradient sequence C, we define for all uq G V , s G N, 
and all times t the set of level-s paths starting at node uq at time t to be 

p u (t) -={P= (uo,...,u k )\K p < C s AVi G {0,...,fc-l} : {Ui,u i+ i} G £(£)}. 

Definition 5.3. For all paths p = (u, . . . , v), all s G N, and all times t we define 



e p (t) := L u (t) - L v (t) 



SH 



V 



Given a gradient sequence C , we further define for all u G V that 

E s u {t):= max {$(*)}. 

Definition 5.4. For all paths p = (u, . . . , v), all s G N, and all times t we define 

rP s p (t) := L v {t) - L u {t) - ( s + - ) K p . 



2, 
Furthermore, given a gradient sequence C, we set for all u G V 

K(t):= max{^(t)}. 

A certain clock skew that depends on the given gradient sequence C is allowed. If this bound is 
not violated, we say that the system is legal. Theconcept of legality is formally defined as follows. 

Definition 5.5 (Legality). Given a weighted, dynamic graph G and a gradient sequence C, for 
each s G N the system is s-legal with respect to C at time t and node u G V , if and only if it holds 
that 

Kit) < °±. 

and 

Kit) < c s . 

The system is C-legal at t and u if it is s-legal for all s G N at node u and time t with respect to C . 

We start our analysis by showing a few straightforward properties. 
Lemma 5.2. The following statements hold at all times t and all nodes u G V. 
(i) The system is 1-legal. 
(ii) Vs,s' G N, s' < s, P°(t) C P M S ' (£). 
(Hi) V S , S 'GN ;S ' <s, K(t)< *£(*) 
(iv) Vs,s' G N, s' < s, E s u (t) < E*'(i) 
(v) If for some s G N the system is s-legal and C s = C s +i, then the system is also (s + l)-legal. 
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Proof. Statement (i) holds by definition as for any path p = (u,...,v) and any time t we have 

max{^(i),^(i)} < \L u (t) - L v (t)\ < Q(t) < ^-. 

Statement (ii) is a direct consequence of Algorithm [T] and Definition 15.11 since for all nodes v and 
all times t it holds that N£(t) C N£ (t) and C s < C s /. Statements (m) and (if) thus follow from 
Statement (ii). Finally, Statement (v) is deduced from Statements (in) and (iv). D 

The s-legality can be used to prove a bound on the clock skew between two nodes u and v. 

Lemma 5.3. Assume that for some s £ N, t/ie system is s -legal at node u £ V and time t. If 
p=(u,...,v) eP°(t), then \L u (t) - L v (t)\ <(s + l)C s . 

Proof. Since the system is s-legal at u at time t, we have that 

L u (t) - L v (t) - sC s < L u (t) - L v (t) - sk p = e p (t) < K(t) < C s 

and 



I) C s < L v (t) - L u (t) - (s + I) k p = r p (t) < %(t) < ^ 



These inequalities imply the claimed bound on the clock skew. □ 

In order to prove the claimed bound on the stabilization time, we require a stabilization condi- 
tion, which depends on the s-legality of the system for a certain s £ N. 

Definition 5.6 (Stabilization Condition). Given u £ V, s € N, s 7^ 1, and a time interval [to,ti], 
we say that u satisfies the stabilization condition on level s during [to, ti] if and only if 

• For all s f £ {2, . . . , s — 1}, the system is s' -legal at u and all t £ [to — C s /_i/((l + p)n),ti\. 

• We have for all t £ [to, t\] and all r £ N that 

|Lu(t) _ ri ,)|>(i±(i±lM^zi. 

A* 

Given the stabilization condition, we can conclude that certain paths must exist for a certain 
period of time. 

Lemma 5.4. Assume that node u £ V satisfies the stabilization condition on level s £ N, s 7^ 1, 
during the time interval [to, *i] and let p = (u, . . . , v) £ P^(t±). Then p £ P£(t) for all 



t £ 






Furthermore, if w € iVJ(ti) and £,f u ^ VjW) (h - t {V)W} ) > or £^ u _ u) (tx - T {v>w y) > 0, then 
(u,...,v,w) £ i*J(t) /or all 

t£ 



C s _i 
(l + p)H 



and this time interval is not empty. 
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Proof. Let r G N be maximal such that L u (t) > T s for all t G [to,ti]- Since clock values are 
continuous, the stabilization condition yields that 



L u (t) G 



r(r) + (1 + (s + l)/i)C 8 _i r(r+1) _ (1 + (s + l)/i)C 8 _i 



(8) 



for all £ G [io,*i]- Set X := {(x,y) \ {x,y} G p}U{(v,w)}, i.e., the set of (directed) edges containing 
the edges of p with arbitrary orientation and, in order to prove the second statement, the edge 
(v,w). Now let 



t'e 



k 



Cs-l 



-,h 



be minimal with the property that X C -E(i) for all £ G [t', t±\. Because p G P£(ti), the definition 
of t' guarantees that for any edge (x, y) G X it holds that u and x are connected by a subpath of 
p that exists at time t'. Hence, we can apply Lemma 15.31 for s — 1, as the system is (s — l)-legal at 
u and time t' (recall that the system is always 1-legal). We get that 



and 



Therefore, if 



L x (t') < L u (t') + sC^ < T^ 
L x (t')>L u (t')-sC s ^>T^. 

I Cc — 1 

t' > t 



we can apply Lemma [4.41 (for s' = s) to all pairs (x,y) G X in order to see that a time £ exists with 

C s -i 



f >te 



to 



;h 



(i + pV 

such that X C £*(£) for all t G [t, ti], contradicting the minimality property of t' . Thus, 

Cs-l 



t' = t 



In particular, j> G P„(£) for all 



t G 



to 



(l+/f)/i 

C s _i 



,*i 



(i + pV 

as claimed. 

Define p' := («,... , v,w). To prove the second statement of the lemma, we first show that 
L w {ti - T{ V)W y) > T{\ Recall that K{ VjW y > (1 + p)/J,T{ VjW y, implying that n p > > (1 + p)/iT{ V]tu }. 
Since by assumption f£,(t x - T{ t , it „}) > or ^^ ... jU )(*i ~ T K«>}) > °> we have that 

Ci 
2 



— > ^(tl - T-{U,W}) 

> |L u (ti - T{„ jUI }) - L m (ii - T{„ >u; })| 

= max{^,(ti - T {V)W y),^ w>v> ^ u) (h - T {v>w y)} + SK p , 



> K K 



(9) 



> (1 + p)a">,™}, 
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i.e., ts VjW \ < Ci/(2(1 + p)p). Therefore, if L w (t — ti v>w \) < T\ , we had that 

Luih) < L u (tx - t {vM ) + (l + p)(l + h)t {v>w} 

< L w (ti - t {VjW} ) + Q(ti - t {V)W} ) + (1 + p)C 1 /{2p) 

< r i (r) + (l + 2 / u)C 1 /(2 / u) 

< L u (ti), 

a contradiction. Thus, if t w denotes the time when L w {t w ) = T^ , Lemma [4. 41 shows that v G N^(t) 
at all times t G [t w , t\ — T{ v ^ w }\ ^ 0. 

Now we claim that p' G -P«(ii — T {iyw})- Assuming for the sake of contradiction that the 
statement is false, let s' G {1, ...,s — 1} be maximal such that t> G N^(ti — t^ vw j), i.e., p' G 
^« (*i ~~ r {«,™})- Since the system is s'-legal at u and time t\ — T{ VjW }, by assumption we either have 

< £p/(ti -t {u>to} ) 

= Cp'(*i - t>,™}) - (s - s')v 

< C s /-«y, (10) 



or 



^ C(t,;,„,..., U )(tl ~T{v,w}) 

= C(i,«,...,u)(*l - r {«M) ~ ( S ~ S 'K' 

< Cgt-Kpf. (11) 



Both cases imply that «y < C s >. We get that 



'{«,«;} 



< ,- < 



(l + p)/Jl (l+p)li' 



Moreover, L w (t\ — T{ VjW }) < T^! v since otherwise Lemma |4~41 yielded that v G N^ +1 (ti — T{ VtW y), 
which is impossible due to the maximality of s' and the assumption that v ^ N^(t-i —Tr VtW x). Thus, 
invoking Lemma 15.31 leads to the contradiction 

L u (h) < L u (ti - t {v>w} ) + (1 + p)(l + h)t {v>w} 

(1 + p)C s , 



< L w (h - t {v>w} ) + (s' + l)C a > + 
(r) (l + (s' + 2) M )C s 



/' 



< Lu(ti). 

We conclude that it must hold that p' G P„(ti — t/ UjIU \). Furthermore, Inequalities (fTUj) and (fTTj) 
for the value s-1 show that ti-r^^} > t -C s -i/((l+p)p), i.e., [t — C s _i/((l+p)//),<i— T{„ ]U ,}] / 
as claimed. Finally, using the same reasoning as for the statement that p G P£(t) for all t G 
[to - C s _i/((1 + p)p),h], we see that p> G P^(t) for all t G [to - C 8 _i/((1 + p)//),ti - t { „ jW} ], 
concluding the proof. D 
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Assuming that the stabilization condition holds on a certain level sat a node u and that 3* is 
positive throughout a certain interval, we can now give an upper bound on the change of H® . 

Lemma 5.5. Assume that a node u £ V satisfies the stabilization condition on level s G N, s^l, 
during the time interval [to,ti\. IfB^(t) > for all t G [£o,£i], then a time 



t'e 



C s —i 



exists that satisfies 

E s u (t t ) - E s u (t') < L u (t ± ) - L u (t') - (1 - p)(l + p)(t x - t') - (1 + p)//(t - 0- 

Proof. Set 1*0 := ^ and let p = (no, • • • , Uk) be a path maximizing 3® (£) at a time £ € [to, t{\. Since 
3„(t) = Cp(^) is positive, we know that uq / Uk, i.e., the path is non-trivial. As K( Uo ,...,u k _ 1 ) < K p < 
C s , it follows that (no, . . . , ttfe-i) £ f„(t). Hence, we have that 

L U fc _i(*) - Aifc(t) > *«{Ufc_i,U fc }j 

since otherwise 

SnW>e { S U0 ,...,n fe _ 1 )( i )>^( t )= S n(t)- 

If for all i> G iV^ (i) we have that 

Lu fe (t) - £«(*) < SK{ % ,«} + 2yUT{ Ufe iV j, (12) 

FC states that r Uk (t) = 1 + p. Now let 9 G [to,^i] be the minimal time such that for all t € (0,£i] 
and any path p = (uo, ■ ■ ■ ,«&) maximizing S*(i) Inequality (fT2|) is satisfied for all v G N^ k (t). We 
get that 

H^tx) - Z s u (6) < L u (h) - L u (9) - (1 - p)(l + p)(h - 9), (13) 

since, by definition of 9, the nodes at the ends of paths maximizing 3* are increasing their logical 
clocks at least at rate (1 — p)(l + p) throughout the time interval (9, t±\. 

If = to i we set t' '■= to and are done. Otherwise, we use the fact that at time 9 for some path 
p = (uo, . . . , Uk) maximizing 3„(#) we have that 

3v G NZ k (0) : L Ufc (0) - L v (9) > SK {ukM + 2/ir {nfeil , } . (14) 

Set p' := (no, . . . , Uk,v). We estimate 

&(6 ~ r {uk ,v}) = & (*) " ( L «W " M0 " ^,»))) + L ^°) ~ L -(° ~ T {u k ,v}) 

> e p (0) + (L Uh (9) - L v (9) - sK {UkM ) 

-(L u (9) - L u (9 - r {uktV} )) + (1 - p)T{ Uk>v } 

na 

> g(0) - (L u (0) - L u {9 - r {ukM )) + (1 - p + 2/i)r {ufci „ } 

= 3* (0) - (L tt (0) - L u (0 - r WM )) + (1 - p + 2p)r {UkM (15) 

> 0, 
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where in the last step we used that (1— p)p, > 2p. Hence, Lemma |5\4"1 yields that p' G N^(6 — T { Uk ,v})i 
giving 

-1(8) ~ -1(0 ~ T {u k ,v}) < -1(6) ~ £,p>(8 -T{ Uk)V }) 

COD 



< L u {6) - L u (6 - r {uktV} ) - (1 - p + 2p)r {uk:V} . 



We conclude that 



C3 



- S u(ti)-K(8-T{u k ,v}) < L u (t 1 )-L u (6-T {uk:V} )-(l-p)(l + p)(t 1 -(8-T {uk:V} ))-(l + p)pT {uk:V} . 
Recall that 6 > to- According to Lemma 15.41 it also holds that 

Cs-l 



T {uk,v} 



to 



:i + p)» 



h - r {UktV} 



Thus, if 9 — Tf UkjV \ < to, the statement follows by setting t' := 6 — Tf UkjV \. Otherwise, we repeat 
this argumentation inductively, in the next step considering the time interval [to, — T {u h ,v}]- Since 
in each step we go back in time by at least mm x ^ y ^v{ T {x.y}} > an d at most until we reach 
to — C s _i/((1 + p)p), the induction halts after a finite number of steps at a time 



t'e 



to 



C s -i 



■)*0 



(i + pK 

for which it holds that 

B u (ti) - E u {f) < L u (h) - L u (t') - (1 - p)(l + fj)(ti - t') - (1 + p)p(t - t') 
as claimed. 



D 



then 



We need another simple lemma that roughly states that if a node is in fast mode, the slow mode 
condition SC is false. This lemma is basically an alternative formulation of Lemma 14.31 

(r) 

Lemma 5.6. Assume that for some node u G V , s G N, and times to < t\ we have that T s < 
L u (to) < L u (ti) < T^ r+1 \ for some r en. If 

t' := min{t G [t , h] | L u (*i) - L u (t) < (1 + p){t x - t)} > t , 

3w G K(t') : L w (t') - L u (t') > (s + i j k {uM 

or 

Vv G N*(t') : L u (t') - L v (t') <( s + l) «{«,„}■ 

Proof. Assuming the contrary, the logical negation of (|16p V (|17|) is 

Wv G 7V*(t') : L v (t') - L u (t') < (s + £) « {u>t)} 
A By; G N°(t') : L u (t') - L^(t') > (s + ^J « {u ,™ } . 



(16) 
(17) 
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Due to the assumed bounds on the logical clock value of u at any time t £ [to,ti], we know from 
Algorithm Q] that no neighbors are added to N£ during this time interval. Because edges that are 
removed at time t' are not in N^(t') and iV* is finite at all times, there must be a time interval 
of non-zero length ending at time t' during which N£ does not change. Thus, as logical clocks are 
continuous and t' > to, a time t £ [to,t') exists such that for all 9 £ [t,f] it holds that 

W £ JV*(0 = Nffl) : L v {6) - L u {9) < (s + £) K {u>v} + 5 
3w E N°(t') = N°(9) : L u {9) - L w {9) > (s + ij K {u>w} - 5. 



A 



Due to Condition SC, we get that r u (9) = 1 for all 9 E [i,t'] and thus 

£«(*i) " L u(i) = L u {h) - L u {t') + L u (t') - L u {i) < (1 + p)(ti - t), 

contradicting the definition of t' . D 

The next lemma is essential and it takes quite some work to prove it. It states that if for all 
level-s paths starting from node u and ending at some node v the stabilization condition is satisfied 
at node v throughout a certain time interval, then \l/* E 0(—C s -i) holds in a certain sub-interval. 

Lemma 5.7. Let u £ V and assume at all times t £ [t, i] for all paths p = (u, . . . , v) £ P£(t) that 
the stabilization condition on level s £ N, s ^ 1, is satisfied at node v. Let At := C s _i/((1 — p)fi). 
Then, it holds for all 

Cs—l 

t + At+ —j- \ ,t 



te 

that 



KM < 2pAt 



(i-p)m' 

Proof. Set Uk '■= u and assume for the sake of contradiction that at some time to £ [t + At + 
C s _i/((1 + p)/x), t] a path p = (v,k, • • • , no) £ Pu(to) maximizes ^(io) > 2pAi, i.e., 

^p(*o) = *S(*o) > 2pAt (18) 

Part I. Getting closer to u^. We define a sequence of decreasing times to > ii > • • • > 
ti+i > to — At > t + C s _i/((1 + p)//) inductively. Given tj, we define 

t l+l :=min{t£ [t - At,^] | L Ui (U) - L Ui (t) < (1 + p){U - t)} . (19) 

For i < k, time tj+i is well-defined, as clock values are continuous and L Ui (ti) — L Ui (ti) = = 
(1 + p)(U — ti). We will see later that the construction can never reach node u&. We halt the 
construction at index I if tg+i = to — At or if 

3w £ Nl(t e+1 ) : L w (t e+1 ) - L Ul (U +1 ) > (s + -j K {ueM . (20) 

Otherwise, note that Lemma [5.41 states that p £ P^it) for all t £ [t, to], implying that Ui satisfies 
the stabilization condition on level s throughout [t, to]. Thus, Lemma 15.61 yields that 



to £ K.(t i+1 ) : L Ui {t) - L v {t) < I s + - j k {UiM . 



(21) 
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We show by induction that for all i S {0, ...,£} and for all t £ \ti+i, h] it holds that 

$*,...,«>)(*) > *«(*>) + K(U< 2"" fc) " (! + /")(*o " *) + W*o) " W*)- ( 22 ) 

Let t £ [ti,to]. For the base case we compute 

t(u ,..,u k )(t) = t(u ,...,u k )(to) ~ (L uo (t ) - L uo (t)) + (L Uk (t ) - L Uk (t)) 

(IS) 
> f(«o,..,« fc )(*0) - t 1 + ^° " *) + Lu ^^ ~ Lu ^ 

= %{to) + y - (1 + p)(to - t) + L Uk (to) ~ L Uk (t) 

™ *u(*o) + y " (1 + P)(*o - t) + L Uk {t ) - L Uk (t). 

As for the induction step, assume that the claim holds for i < £. Note that i < £ implies that 
ti+i > t as otherwise the construction would halt at index i, a contradiction to the definition of £. 
From Inequality (|21|) we know that 

Luiik+i) - L Ui+1 (t i+ i) < f s + - J K{ Ui)U . +1 }. (23) 

Thus, we can write 

^C" i+ i,...,ufc)(*«+i) = C( Ui ,..., Uk )(ti+i) ~ L Ul (t i+ i) + L u . +1 (t i+1 ) + sk {u ^ u . +i} 
> $(u i ,...,u k )K t i+l) g 

'> K(to) + K{u ' + ^ Uk) 

-(1 + p)(to - t i+1 ) + L Uk (t ) - L Uk (t i+1 ). (24) 



We need to show that i + 1 ^ k as claimed. Assuming the contrary, Inequality (|24p leads to the 
contradiction 

(24) 

° = C(„ fc )(*fc) > K(to) ~ (I + p)(to ~ t k ) + L Uk (t ) - L Uk (t k ) 

> %(t ) - 2p(t - t k ) 

> K(to) - 2 P At 

Gi 
> o. 

Hence it follows that i + 1 < k. 

Now let t £ [ti+i , ti+2] (recall that ij+i > to — At and i + 1 7^ fc, i.e., time ti+2 is defined). We 
obtain 

£(t H +i,...,u k )( t ) - Z(u i+1 ,...,u k )( t i+i) ~ ( L u i+1 (ti+i) - L Ui+1 (t)) + (L Uk (t i+ i) - L Uk (t)) 

Gi 

> Z(u i+u ...,u h )(ti+i) - (1 + p)(U+i -t) + L Uk {t l+l ) - L Uk {t) 

> K(to) + K+1 2 "-" fc) - (1 + P)(U+1 -t)+ L Uk (t ) - L Uk (t), 
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i.e., the induction step succeeds. 

Evaluating the statement at time i^+i, we obtain for any t G [i^+i,to] that 

*(«<,..,«*)(*) = £(«,,„.,„*) fa+i) + M*) ~ LuM+i) ~ (L Uh (t) - L Uk (t £+1 )) 

(22} 

> Kfo) ~ (1 + p)(to ~ t £+1 ) + L U£ (t) - L Ui (t i+l ) + L Uh (t Q ) - L Uk (t) (25) 

> K(to)-Mto-tt+i) (26) 

> K(t ) - 2 P At 

m 

> 0. (27) 



in 



Part II. Getting further away from U}~. We define a finite chain of nodes W£,...,w. 
and times tn + \ > t £+ 2 > ■ • ■ > tm+x = to — At (where w £ := u £ and t £+ i are the node and the 
time, respectively, at which the previous construction left off). The construction is inductive and 
maintains the following properties: For all i G {£ + 1, . . . , m} it holds that 

L Wi (U) - L^^iU) > I s + - J K{ Wi>Wi _ l} , (28) 

and for all t G [£i+i,£i] we have 

e {Wi ,..., we=Ui ,..., Uk) (t) > q Ui _ Uk) (t e+1 ) + ^^ - 2 P (t m - 1). (29) 

If t £+ \ = to — At, we have £+ 1 = m + 1 and there is nothing to show. Otherwise, the previous 
construction must have halted because Statement ([20]) was satisfied at time t £+ \ > t m+ i = to — At. 
We choose w £+ i to be the node w from that statement, implying that Inequality (j28[) holds true 
for i = £ + 1. Thus, 

m K (w l+1 ,w t ) 

> £( u „..., Ufc )(*m) + g ' 

i.e., Inequality ([29]) holds for i = £ + 1 at time t £+ \. 

Now assume that for some i G {£ + 1, . . . , m} we have already constructed the chain up to node 
Wi, Inequality ([28]) is true, and Inequality ([29]) holds at time t\ > t — At. We define 

t i+1 := mm{t G [t - At,U] I W*i) - L Wi {t) < (1 + p)(U - t)} , (30) 

i.e., in the same way as we did for the previous construction. 
Hence, for t G [tj + i,tj], 

^(w i ,...,w l =u e ,...,u k )( t ) = £(w l ,...,w l =u l ,...,u k )(. t i) ~ (L Wi (ti) - L w .(t)) + L Uk (ti) - L Uk (t) 
l30t 

> e ir ,..., We=Ui ,..., Uk) (t l ) - 2 P (u - 1) 

= £(tUi_i,...,t<;i=u*,...,Ufc)W + Aoi(*i) ~~ ^Wi_i(£i-l) - S«{iUi,Wi_i} _ 2 P(*i ~ *) 
> ^twi- 1 ,...,w t =ut,...,u k )\ t i) "^ V 5 ^^ ~~ ^ 



»(iui_i,...,^=u«,...,« fc )v v i " 2 

^,...,u fe )(^+l) + — ^f 

23 



'>' &, uAti+i) + KlWi n" Wt) -Mu+i-t). (31) 



If ij+i = to — At, the construction halts. Note that this happens after a finite number of steps 
because clock rates are bounded from above by (1 + p)(l + p), and clock values increase by at least 
minj^gyKs + l/2)n{ xy }} > whenever we move from a node Wi to a node Wi + \. 

If tj + i > t — At, we claim that 



3w £ N^(t i+1 ) : M*i+l)-W*i+l) > ( S+ 2J 



u {uj;,io}- 



(32) 



We will now prove this claim. Observe that, by using Lemma 15.41 inductively, for 



t+i 
r ,— / , T {«ii,iti i+ il 



j=£ 

we get that (wi, . . . , w^ = U£, . . . , Uk) S P^.(t) for all t £ [i, ij — r]. In particular, 

r f^-p)<^ V . (33 ) 

(1 + p)p ~ (1 + p)p 

Let r be maximal such that L Wi {ti — r) > T s . The continuity of logical clock values and the 
assumption that Wi satisfies the stabilization condition on level s during the interval [t, t{ — r] imply 
that 

Tj r) < L Wi (t) < L Wi (t i+1 ) < L Wi (ti) < L Wi (U - r) + (1 + p)(l + p)r 

? 1 „ i(t( _ r)+ (i±^<r<-). 

A* 

Hence, according to the definition of tj + i and Lemma 15.61 it follows from the assumption that 
Statement f|32[) is false that 

L Wi (U+i) ~ Lw^iti+i) < ( s + - J k {uH:Wi _ i} . (34) 

We infer that 

Lwi-AU) — -C'Wi-iW+l) (-^iUi(*i)— ( «+ ^ j K {»„i»,-i} J 

£ Wi (tj + l)- ( S+ -J K{ Wum _^ 

= L Wi (ti) — L Wi (ti+±) 

l30t 

< (l + />)(ti-t m ), 

which yields 

L Wi _ 1 \ti-i) — L^^^tj+i) = L w , i _ 1 (tj_i) — L Wi _ 1 [ti) + L Wi __ 1 {ti) — L Wi _ 1 {tiJ r i) 

(1301 

< (l+/9)(ti_i -t i+ l). 
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This contradicts Definition (|30p . implying that indeed Statement (|32p must hold true. Thus, we 
can define tUj+i := w from Statement (j32[) . complying with Inequality ()28p . Moreover, 

^(«;i + l,...,^=Mf,...,w fc )( i «+l) > 6( Wij . ..,iu i =iy,...,u fc )W+l) + ^Wi+i(*i+l) — L Wi (ti + l) — SK{ w . )Wt+1 } 

^ s(iu i ,...,iu i =tt < ,...,tt fc )V fc *+i; t- 2 



GU 



K 



(io i+ l,...,iu^) 



> ^,..., Ufc) (^ + i) + ^f^ - 2p(t l+1 - t), 

showing that Inequality (|29p is true for the index i + 1 and time ij+i. 

This completes the induction step, as we started from the assumption that node Wi satisfying 
Inequality (|28p has been chosen and Inequality (|29p holds at time tj > to — At. 

Part III. Bounding H s . We proceed by constructing a third and last finite sequence of times 
to = $o — ^l — ^i — ^2 > #2 — • • • While going back in time, we will trace a subsequence of the 
nodes we, ■ ■ ■ , u> m . The construction halts at time 9h if we have Oh < to — At = t m +i, and it halts 
at time 01 if we have 9' h < to — At. Let ij G {£,..., m}, j G {1, . . . , h}, denote the minimal index 
satisfying 9j G (t^.+i, 0,-_i], or m + 1 if 6*,- < t m +i. We will maintain the properties that (i) for all 
j £ {0, . . . ,h — 1} and all t £ [to — At, 9'A we have pj := (u;^ , . . . ,W£ = U£, . . . , Uk) G P£j (t), (w) 
for all #'• it holds that 

S^ {%) > e po (to) - (L Ui (t ) - L Wi . (9' 3 )) + (1 - p)(l + /z)(t - 0j.) " (* + ^) «K,..^)> (35) 
and (iii) for all 9j we have that 

3^ (%) > C(to) - CMio) - ^_ x (%)) + (1 - p)(l + M)(to - ^i) " ( s + ^) ^H-.,^' ( 36 ) 

Recall that u = u/, and W£ = U£. To anchor the induction, observe first that since p G P£(to), 
also (u k , ...,ui) G P£(to), implying that p G P^ t (to). Hence, E^(to) > £ Po (*o) and Statement (ii) 
is trivially satisfied. Furthermore, since by assumption for node Uk = u the stabilization condition 
holds during the time interval [to — At, to] C [t + C s -i/((l + p)p),t], Lemma EH thus states that 
(uk, • • • , ui) G P„(t) for all t G [to — At, to], showing Statement (i) for j = 0. 

We need to prove Statement (Hi) for j = 1. As y>o £ PwM) for all t G [t£ + i,t ], it follows that 

123 

s;w>cw > o. 

Furthermore, po £ -P^L (t) entails that the stabilization condition holds at node ui at time t. Hence, 
we can apply Lemma [531 to the time interval [ti+i, to], yielding time 9\ G [te+\ — C s _i/((l+p)/i), t|+i] 
with the property that 

> 3^ (to) - (L U£ (to) - L„<(0i)) + (1 - p)(l + m)(<o - #i) + (1 + P)^(t£+i - #i) (37) 






> £L(t ) - (^,(to) - W0i)) + (1 " P)(l + A*)(*o - 8i), 



i.e., Statement (Hi) holds for j = 1. 

Assume now that Statements (i) and (ii) hold for some value j > and the construction does 
not halt at time #', i.e., #'■ > t m +i- We make a case distinction. If 6*' < i^.+i, we set 9j + \ := #', 
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and Statement (Hi) for j + 1 trivially follows from Statement (ii) for j. Otherwise, if 9'- > ti-+i, 
due to Statement (i) for j we have for all t G [ti + i,9'-] C [to — At, 9'] that p 7 - G P*. (t). Moreover, 

the minimality of ij guarantees that #'• < tj , implying that t G [tj.+i,tj]. Therefore, 

^w > e Pj (t) 

(29) 

> ^ (t, +1 )-2/>(t,+i-t) 

(26) 

> K(to) ~ 2p(t - *) 

> *»(to) - 2pAi 
GHJ 

> 0. 

Since pj G P^. (t) is equivalent to (uk, ■ ■ ■ ,ui = W£, . . . ,Wu) G Pn(t), by assumption 10$, satisfies 
the stabilization condition during the time interval [tj +i, #'•]. We apply Lemma |5.5| yielding the 
time 6j+i G [t, t^+i] that satisfies 

S s Wi . (0 i+1 ) > 3^ (0J.) - (L^ . (0j.) - L^. (0 i+1 )) + (1 - p)(l + M)K- - %+i) 

+(1 + P )n(t ij+1 - 9 j+ i) (38) 

(35) 

£,(*,) - (£«,(<o) - A*. (%+i)) + (1 - p)(l + M)(*o - j+ i) 

s 2 j K ( wi j>—> w *y 

Therefore, in both cases Claim (ra) is established for j + 1. 

Next, assume that Statement (m) holds for some value j and Statements (i) and (ii) are true 
for j — 1, and also that the construction does not halt at time 9j, i.e., 9j > i m +i. According to 
Statement (i), pj_i G P^,. (t) for all t & [to — At,0j] C [t — At, #o_i], thus the inverse path is in 
P^(i). Moreover, the minimality of ij ensures that 9j < ti for all i > ij. Define 

^ f ^, ] ,,., 3 _ 1 ) "K,-,^.,,) 

- .4-.. T{ ^^- 1} - 8 M 2(2p + 2(1 + p) M ) ^ 

£ — ij — x i J- 

and 8'- := 6j — r (note that r = if u>j. = u>, _ 1 ). Since the stabilization condition is satisfied 
by node u throughout the time interval [to — At, 0j], inductively applying Lemma 15.41 gives that 
Pj G P^. (t) for all t G [to — At, 9'A, proving Statement (i) for the index j. 

Let (wi j _ 1 , . . . ,x) denote a path maximizing 2j^. (9j). Since Pj-i G P^,. (@'j-i) ^ State- 
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ment (i), we know that (ip^Jflj) < £f w . x)(%)- Thus, as Oj £ [tj j+ i, t^], we can bound 

^ ] ,...,w lj _ 1 ,...,x)( e j) = C( Wi Wi ._ 1 )(^j) + £(W ._ 1 ,...,x)(°j) 






(22J «W, ...,«>/) 

> £,fa +1 )-2pfo +1 -«>,■) + 






(251 «( Wi .,...,^) 

> ¥£(*,) - 2p(t - *;) + — -^ 

"'(m> . ,...,Wf) 
l® K (uj;., ...,10 £ ) 

> . 



Therefore, 



ef Wv ... )Wv ...,,)(^) = ^ v ...,. v ...,,)(%)-(^(%)-^(^)) + l,(%)-l x (^; 

K (w i:j ,...,we) 

T 



> V -(2P + (l+P)/*)(fli-ty 



^(tOi . ,...,U>») 

= J 2 f; -(2p+(l + p)^)r 

Eg 
> o. 

By virtue of Lemma l5~4l we obtain that (w^. , . . . , Wi j _ 1 ,... ,x) £ P£ Ji (#'•). 
We conclude that 

-mi j) > ^{w i ,,...,w i ,_ 1 ,...,x){Q'j) 

= L w .. (O'j) - L Wij _ i (6j) + iw <i _ 1 (fy) - L x (9j) + L x (0j) - L x (0j) - sk^ w .^__^ w .,_^^ x ) 

> L Wij {9' 3 ) - l Wij _ x (Oj) - ^ K .,...,^_ i) + (i - pm - e ! 3 ) + ^_ i ,...,, ) (%) 

> L m 3 (Qj) ~ Lwtj.i W) ~ I s + g J K (»v.,» Vl ) 

+(1 - p + 2 M )(^- - 0J.) + H^ (%) (40) 

> ^ ( f o) - 0M*o) - A^ (^)) + (1 - P)(l + A*)(*d - O'j) ~ ( a + g J «(«*,.,...,«*)■ 

This proves statement (u) for the index j, completing the induction step. 

Part IV. Putting everything together. We make a case distinction. If the previous induc- 
tion stopped at a time Oh < to — A, we preserve the term (1 + p)p(ti h _ 1+ i — Oh) from Inequality (|38j) 
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(or from Inequality (|3T|) if h = 1) in the last step, which yields that 

Hi ifc _ i (0/0 > e po (to) - (L ue (t ) - L Wih _ x (6 h )) + {l- p )(l + p)(t - e h ) 

- ( a + - J KK h _ 1 ,..., Wi ) + (1 + p)M^-i+i - 0/0 
> ^,(*o) - (A*(*o) - L Wih _ x (V 1+ i)) - (1 + P)(t ifc _ 1+1 - 0/0 

+(l-p)(l + ^)(t o -0h)- ( s + 2 ) K (».n.-.«") 

= £p (*°) ~~ ( L ^(*o) - L Ut ( tt+1 )) - (1 + p)(ij h _ 1+ i - 0^) 
*h-i 



+ ^ [ L i»i(ti+l) -LwiSi) ~ ( s + g ) K {™i,w«-l} J 



i=M-l 

+(l-p)(l + ^)(io-0h) 



> 



^po^o) - (£ U£ (*o) - L udtt+l) ) - (1 + p)(t» h _ 1 +i - 0/0 



*h-l 



+ ]T (£ Wi (ti+i) - L TOi (ti)) + (1 - p)(l + ft) (to - 0/, 

i=M-l 
l30t 

> ^o(«o) - (L ul (jto) ~ L Ul{ t l+l) ) - (1 + p)(U+i - e h ) 

+(i- P )(i + fi)(t -e h ). 



Furthermore, setting t = to in Inequality ([25 

(f25t 



£p (*o) > *£(*o) - (1 + p)(«o " tt+i) + L ue (t ) - L ue (t e+1 ), 



leading to 



K ih , (0/0 > K(to) - (i + p)(t - 0/0 + (i - p)(i + m)(*o - 00 

> *i(<o) + ((l-p)/i-2p)A< 

CHJ 

> (1 - p)pAt 

= C s -\ 

Statement (i) for h — 1 yields that p/i_i 6 i 3 ^ (0/Oj therefore it follows that Wi h _ 1 satisfies the 
stabilization condition at time 0h>t and thus the system is (s — l)-legal at Wi h _ 1 at time 0^. This 
is a contradiction to the previous inequality because 

K lh Jo h )<^Jo h )<c^. 

The other case is that the induction halts at a time 6' h , i.e., i^ = m. In this case, we preserve 
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the additional term (1 + p)p,(9h — 0' h ) from Inequality (J4tTj) in the last step, yielding 
KM) e P0 (k) - (L U M - L Wm (9' h )) + (1 - p)(l + M )(<o - B h ) 

s+ 2) %.■■■.«<) + C 1 + pV(<^ - O 
C^o) - (A*,(«o) - WO) + (1 - P)(l + m)(*o - 0/0 

- f s + g J re («w-,^) + C 1 + PV(Wl - &h)- 

Thus, with 6' h taking the role of Oh, w m replacing W{ h _ 1 , and substituting t m+ \ for U h _ 1 +i, analo- 
gously to the previous case a contradiction occurs, concluding the proof. D 

The final lemma states that if the system is (s' — l)-legal for all s' G {2, . . . , s — 1} in certain 
time intervals at all nodes whose clock skew to a node u is at most 0(sC s -i), then there is a 
(sub-)interval during which the system is s-legal at u. 

Lemma 5.8. Let s £ N, s / 1, and u G V such that for all times t G [t, t] and all r£ff, 

|L M (t)-rj-)|> (1 + (3s + 1) ^- 1 . 

Assume that for all times t E [t,i] and nodes v € V with the property that 

\L v {t) - L u (t)\ <2sC s . 1 

the system is s' -legal at v for all s' G {2, . . . , s — 1} and all times in [t — C s /_i/((l + p)p),t\. Then, 
if C s > C s _i/cr ; the system is s-legal at u at all times 

te [{t_ + 2C s . 1 /{{l- P 2 )p),i}. 

Proof. Let 

tl e[(t + 2C s ^/{(l-p 2 )p),i] 

and p = (u,...,v) G P£(t'). By assumption, the stabilization condition on level s holds at u at 
time t' . We apply Lemma 15.41 to see that p G P^(t) for all t G [£,£']■ Hence, the (s — Illegality of 
the system at u at time t permits to apply Lemma 15.31 which yields that 



\L v (t) - L u (t)\ <sQ 



s-l- 



Now let (v, . . . ,w) G Pv(t)- Thus, as by assumption the system is also (s — l)-legal at v at time 
t, the triangle inequality and Lemma 15.31 yield that 

\L w (t) - L u (t)\ <2aC 8 _ 1 . 

We conclude that (i) for all s' G {2, . . . , s — 1} the system is s'-legal at node w and all times 
t G \t— C s '_i/((1 + p)p),t'] and (ii), using the triangle inequality once more, 



|Mt)-^l> (1 + (j + 1)M)C - 1 
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for all r E N. 

Consequently, the stabilization condition holds at node w during the time interval [t,t']. Thus, 
the preconditions of Lemma 15.71 are met at node v for the time interval [t, t'] , giving that for all 

te[t + 2C s _ l /((l- P 2 )p),t>], 

wm <r 2pCs ~ l ® 9izl < 9i 
v[) < (1 - p)fi ~ 2a ~ 2 ■ 



Since this statement holds for all paths p G P£(t'), we have that 

S£(0 = max Uf v u) (t') + ^-\ 

p=(u,...,v)eP?,W) l r W-w v 2 J 



Moreover, from the trivial path (u) we get that 



< max 

p=(u,..,i))6P„ s 

< G, 



*S(f ) < y- 

Thus, the system is s-legal at u and all times 

t'e [(t + 2C s ^/(l-p 2 )fi),i] 
as claimed, concluding the proof. □ 

We are now in the position to prove the main theorem, which shows that the system is always 
legal with respect to some specific gradient sequence. 

Theorem 5.9. The system is legal at all nodes and all times with respect to the gradient sequence 

C := (20, 2Q, 2Q/a, 2Q/a 2 , 2Qja\ ...). 

Proof. Define for s £ N that 

_ (2 + (6a + 8)/i)g 

and 

4(1 + n)g 



V,:-- 



(1 - p)^o- max ^- 2 '°} ' 
i.e., according to Algorithm Q] we have for all r, s £ N, s ^ 1, that 

tO+i > T i r) + 2V -i + A s-i + A,. (41) 

For all s G N U {oo}, s/1, let C(s) denote the gradient sequence C(s) := {C s /(s)} s i £ ^, where 



C s ,(s) :- 



2Qo x ~ s if s' < s 

2ga 2 - s ' else 



30 



We prove the following stronger claim. For all r G N, s G N, s > 3, the system is 



C(2) -legal ifL u (t)e 

C(s) -legal ifL tt (t)e 

C(oo) -legal if L u (i) G 



T ( r ) rp(r) 

ri r ) - a 



Ao- V- 



8-1 



T (r) T (r+1) 



V,_ 2 ,T. 



(r) 



A„- V, 



(42) 
(43) 
(44) 



at any node u G V at all times t. 

Note that since a > 1, the limit T^ is well-defined. Moreover, Mq" is the union of the given 
time intervals for varying r and s. Thus, showing the claim implies that the system is at all times 
and all nodes legal with respect to the sequence C because C s = max s / eNU { 00 |{C s (s / )}. 

Assume for the sake of contradiction that the claim is wrong. Denote by i the smallest time 
when the system is not legal at some node u G V and by s G N the smallest integer such that the 



system is not s-legal at some node u G V at time t. Choose the smallest r such that t > T} 
Trivially, we have that s/ 1 from Statement (i) of Lemma l5.2i Define 



('■) 



t :=t 



V, 



t 



2C s -_i < 2C 5 _i(s) 



(i + P )(i + M ) (1-p 2 )/^- (i-p 2 V 

Since logical clock rates are upper bounded by (1 + p)(l + fi), we have for all t G [t, t] that 

Lu(t)e [L a (t)-Vs-i,L Q (t)]. 



By Statement (v) of Lemma 15. 2} we can exclude Case (|43p for s 
C s -i(s). Thus, either L a (<) > T^\ - A s - - V*_i or L u (i) < T^ r) 



s and Lu{t) because C s (s) = 
A 5 _i - Vg_ 2 . 

We make a case distinction. Assume first that L a (t) < T 5 — A g _i — Vg_2, i.e., Case ([4*2]) 
or ([43]) for some s < s apply to L u (i). Both cases imply that the system is not Cs(2)-legal at node 
u and time i. Algorithm [T] states that if Ly,(i) < Tg , N?(i) = 0. Hence, it must hold that r/1, 
i.e., 



M* 



C x 



> Lu(t) 



(1 + aOCi 



> T, (2) - Vi - Ai > 0, 



(1 + PW A" 

yielding that t — Ci/((1 + p)/i) > 0. As i is minimal, the system is legal with respect to C(2) = C 
at all times t <i and nodes f G V. Furthermore, as already observed, we have for all t G [t, i] and 
all r'EN that 



Lu(t) - T- t 



(r') 



> A, 



;i + (3s + l)/x)C 5 -i(2) 



Consequently, the preconditions of Lemma l5.8l are met for s, u, and the time interval [t,t], yielding 
that the system is s-legal with respect to Cg(2) at time i, a contradiction. 

The second case is that L a (t) > T^ x — A?— Vg_i, i.e., Case ([44]) or ([43]) for some s > s apply to 
Lu(i). Both cases imply that the system is not Cg(oo)-legal at node u and time i. Again, we have 



<r) 



<r) 



that Lu(t) > r^-Aj-Vs-i-Vs-i > T 3 V ; -A 2 -2Vi > Ai and therefore t-C7 1 /((l + p)/i) > 0. 
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L v (t) - 




La(t) - 


2sGs_i(oo) , 


Lu(t) - 


,^,_ s 2(1 + ^)0 
V s -i 4sC/cr 


T (r) 
1 s+l 


■ A s - 2V s -_i - A s -_i - V s '-i 


T (r) 


- A s / + i — 2V S / — Agi — Vy_i 


T (r) 
-'.s'+l ' 


- A s / - V s '_i. 



For all s' G {2, . . . ,s — 1}, t G [£, £], and uGF with |L„(£) — L u (i)| < 2sCg_i(oo) we have that 

> 

> 

> 
> 

> 

Assume for the moment that T 2 = oo. Thus, the previous inequality implies that for all 
s' G {2, ... ,s-l}, times t G [i-Cy_i(oo)/((l+p)/i),f], and v G F with |L,,(t)-L M (t)| < 2sC S -i(oo) 
the system is s'-legal at v and i. Thus, Lemma 15.81 states that the system is s-legal at time t. 

Note that in this setting we get the stronger result that the system is legal with respect to C(oo) 
at any node u and any time t when L u (t) > T^, . Certainly, if we reduce T 2 , this cannot affect 
the execution of the algorithm at any point in time where all logical clock values are smaller than 
T 2 . Thus, we conclude that the system must be C(oo)-legal at all nodes u with L u (t) > T^ 
provided that L v (t) < T 2 for all v G V, which is true at logical times L u (t) G po£ , T 2 — Q). 
Therefore, also the second case leads to a contradiction, implying that the initial assumption that 
our claim is false must be wrong, finishing the proof. □ 

So far we assumed that the bound Q on the global skew is the same in each round. It is not 
hard to see that Q can be replaced by Q^ r ', and the system is legal at any node u after the system 
stabilized, i.e., at all times t when L u (t) G [T^ ,T± ] in each round r. 

Corollary 5.10. Assume that Q^ r > > Q(t) at any time t when some node u G V satisfies that 
L u (t) G [If ,T 2 — Q^ r ')- Then, the system is legal with respect to the gradient sequence 

C (r) := ( 2 gM )2 gM,2gM/(j,2gM/cT 2 ,...) 

at any node u G V and times t when L u (t) G [Tc£ , T 2 — Q^ r '). 

Proof. The proof is carried out analogously to the proof of Theorem 15.91 with the modifications 
that we replace Q by Q^ r > and define C(s), 1/sGNU {oo}, as 

_(2g^a 1 ~ s ' [fs'<s 

WW- [ 2 g(r) a 2-s elge 

Thus, legality on level s and higher is trivially satisfied by Statement (v) of Lemma [5. 21 Therefore, 
the proof does not require any assumptions on the initial state of the system except the bound on 
the global skew, and legality with regard to C^ r ' is established inductively level by level. □ 

If we use the maximum of Q^ r ~ l > and Q^ r ' to define the gradient sequence for round r, then we 
get that the system is legal with respect to this gradient sequence at all times in this round. 
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Corollary 5.11. Define g( r - 1 - r ) := max{0( r-1 ),C/( r )} for all r G N (Wiere we to/ce <?(°) to 6e Oj. 
T/ten £/ie system is legal with respect to the gradient sequence 

cr(r-i,r) := (2g( r - 1 ^) ) 2g( r - 1 ' r ),2g (r_1 ' r) /o-,^ (r " 1 ' r) / o " 2 )--0 

at any node u £V and times t when L u (t) G [Tj ,r| ). 

Proof. By assumption c)( r_1 > r ) is a valid upper bound on the global skew at any time t when some 
node u G V satisfies that L u (t) G [Tj , T^ ). This time we define C(s) as 

r M _ J 2gWo- 1 - s ' ifV<s 

s ' lSj ' \min{2gW - 2 -^2g( f - 1 ^}a 2 - s, else 

Now, at respective (logical) times and nodes, for values s' < s we can infer s'-legality with respect to 
C(s) as in the proof of Corollarv l5.101 For values s'>swe either use Statement (v) of Lemma l5.2l or 
argue analogously to the proof of Theorem 1 5. 91 The latter exploits that, according to Corollary 15. 10[ 
the system is C^ r ' r ~ 1 ' -legal at any node u G V provided that L u (t) G [T^ , T 2 — G^>). As the 
argumentation in the proof of Theorem 15.91 relies only on this range of logical clock values smaller 
than T 2 — Q\ r > if L^it) > Tj , this completes the proof. □ 



Another simplification we made is that a neighborhood set N^ is stored for all s G N. We show 
v that 
round r. 



now that for all nodes u it is indeed not necessary to store any such set for s > Smax(n) in any 



Corollary 5.12. Assume that r, s G N and u G V, where s > SmLx.{u). Theorem \5.9\ and Corollar- 
ies \5.10\ and \5.1f\ hold true even if the algorithm does not implement the fast and slow mode rules 
on level s at u and times t when L u (t) G [T^ r ' , T x ). 

Proof. Consider Theorem 15.91 first. Assume for the sake of contradiction that we have a minimal 
time t, a node u G V and some s > Smax(n) such that the fast or slow mode rule is satisfied with 
regard to s at u and t. Thus, by Lemma 14.2} the fast or the slow condition on level s is satisfied at 
time t at node u. In all cases, there is some node v G N£(t) such that 

\L u (t) - L v (t)\ > sk {U)V} . 

Denote by s' G N the maximal value such that Ks UtV \ < C s i (with respect to the gradient sequence 
C from the theorem), i.e., K{ Uj „} > Cy + i. Since N^(t) C N^(t), according to Algorithm Q] we have 

that s' + 1 < Smax(n), implying s' + 1 < s. Hence, 



© 



max 



{C^ 1 ) (t " T {«.«})' *£*)(* " T i^})} ^ ( s - (*' + l )Hu,v} - (2p + (1 + p)li)r {uM > 0. 



Since t is minimal, the claim of Theorem 15.91 must hold until time t, which implies that the 
stabilization condition on level s' + 1 is satisfied at node u and time t. Thus, Lemma [5. 41 states that 
(u,v) G P£ +1 (t — T{ u „}), implying in particular that H{ u ^ < C s ' + i, a contradiction. Therefore, 

there cannot be a first time t when the fast or slow rule applies for s > sjiyji) at any node and 
any time. We conclude that the statement of the theorem thus must also remain true at all times. 
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Regarding Corollary 15. 101 observe that legality of the system is established inductively, starting 
from the lowest level; no (non-trivial) skew guarantees are given on higher levels. For times t when 
L u (t) < TgJ x — A s — V a — i, the legality of the system at u and time t follows solely from the rules 
up to level s — 1. Thus, also Corollary 15.101 is not affected by the fact that the algorithm does 
not implement the fast and slow rules for levels larger than SmLx(u) at node u and time t with 
L u (t)G[Ti r \Ti r+1) ). 

Finally, we conclude that the statement of Corollary 15.111 remains valid because it is a conse- 
quence of Theorem 15.91 and Corollary 15.101 □ 

It remains to show the optimality of the achieved skew bounds. 

Corollary 5.13. Assume that Condition \4-l\ holds, Q^' G O(D) for all r G N, and fir e G 0(e e ) 
for all edges e that ever exist during the execution of the algorithm. Then, choosing K e G 0(e e ) for 
all such edges, an algorithm A £ A exhibits a stable gradient skew of S°°{d) G 0(dlog fl / p (D/d)), 
with a stabilization time of 0(D/fi). Specifically, if a path p = (u,...,v) exists at time t and it 
has already existed for O(Dffi) time, then \L u (t) — L v (t)\ G 0{e p \og p i p {D / e p )) . These bounds are 
asymptotically optimal. 

Proof. Let Gs = (V, Es) denote the (dynamic) subgraph of the estimate graph G induced by all 
edges {u,v} with u G JV"„ Smax(u) (t) and v G AC nax(u) (t). Note that since 0M G O(D) for all r G N, 
Lemma 14.41 states that any edge that existed at least for the last At G 0{D/ji) time units meets 
this criterion. Hence, for the first claim it is sufficient to show that in Gs we have a gradient skew 
of S°°{d) G 0(d\og p/p {D/d)) at all times. 

To this end, assume that at time t, u, v G V are two nodes in weighted distance d < D in the 
graph Gs, i.e., a shortest path p from u to v in Gs has weight e e = d. Let r, s G N be the unique 
integers such that L u {t) G [T 1 (r) ,T 1 (r+1) ) and n e G [C s (r " 1,r) , C^ l ' r) ), where C^~ 1 ^ is the gradient 
sequence from Corollary 15.111 Recall that a G @(fi/p). The preconditions that Q^ r ' G O(D) for 
all r G N and K e G 0{e e ) for all edges e that exist at time t yield that s G Q(log a (D/n p )) = 
Q(log^/ p (D/d)). Hence, as legality holds at node u at time t with respect to C( r ~ 1 > r > according to 
Corollaries 15.111 and 15.121 Lemma 15.31 states that 



\L u (t) - L v (t)\ <(s + 1)C S G O (d\og 



as claimed. Since this bound is increasing with regard to d, it extends to arbitrary (i.e., non- 
shortest) paths from u to v in Gs- 

The asymptotic optimality of the stabilization time follows from Theorem 6.1 of the paper. The 
asymptotic optimality of the gradient property is shown in [12] . □ 

6 Lower Bound 

In this section, we strengthen the lower bound in [8] to match the stabilization time of A . 
The original lower bound stated, roughly speaking, that the stabilization time of any 5-dynamic 
gradient CSA with a stable gradient skew of 5°° cannot be better than £l(D/S°°(l)) in graphs 
of diameter D. For CSA with 0(log-i/ p L>)-local skew, this bound implies that the stabilization 
time must be Q(D/log 1 / p D). Algorithm ^4 has a stabilization time of O(D), which does not 
match the bound in [5]; however, by refining the analysis in the lower bound we can show that 
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the algorithm is in fact asymptotically optimal in its stabilization time. In the stronger bound we 
reason about the full gradient property, which bounds the skew on paths of all distances, rather 
than just the local skew property, which bounds the skew on single edges. 

Let us call a dynamic gradient CSA non-trivial if it has a stable gradient skew satisfying 
<S°°(1) G o(D). This essentially means that the algorithm guarantees a local skew (e.g., along single 
edges) that is better than the global skew. 

Theorem 6.1. Let T = {/d : Kj" ~~ ^ ^o" I ^ ^ ^} ^ e a family of functions, and let c±,c 2 E (0, 1/16) 
be constants such that for all frj G J 7 we have fo(ciD) < C2D. Let A be a non-trivial stabilizing 
CSA guaranteeing a dynamic gradient skew of fn in graphs of weighted diameter D. Then the 
stabilization time of A is at least Q(D). 

Proof Sketch. We show that for sufficiently large diameters D, we can add a new edge and cause 
the skew on it to be larger than S after £1(D) time. For simplicity we consider only line networks, 
where D G O(n), but the proof can easily be modified to hold in general networks. 

Consider a static line graph over n + 1 nodes Vq, . . . , v n , where the estimate graph is the same as 
the communication graph and the weights of all edges are T. The diameter of the graph is D = nT. 
Let ci,C2 be the constants from the statement of the theorem, and let u := vr cin -],v := v^ n _ Cin ^. 
Finally, let t s > Ts be some time after the stabilization time of the algorithm. By definition of Ts, 
at any time after t s , the skew on any path of weight d cannot exceed 2fr){d). 

The distance between vq and u and between v and v n is at least cin; thus, for all t > t s we have 

L vo (t)-L u (t) < f'D(cin)<c 2 n, 
L v (t)-L Vn (t) < fD(cin)<c 2 n. 

Also, dist(u, v) > n — c±n — 1 — (c±n + 1) = n — 2c\n — 2. 

In [8], we show that we can create an execution E in which 

(a) There exists a time t 2 > t s such that L u (t 2 ) — L v (t 2 ) > \ dist(u, v) > n — 2c\n — 2, and 

(b) The message delays on all edges between vq and u and between v and v n are always at least 

r/(i + p). 

Next we create a new execution E' , which is identical to E until time t\ '■= t 2 — c\n ■ T/(l + p). At 
time t\ in E' , an edge between vq and v n appears. Our goal is to maintain a large skew on {vq, v n } 
until time t 2 to show that the algorithm has not stabilized by then. 

Due to the large message delays, nodes u, v do not find out about the new edge until time 
t 2 . Consequently their skew in execution E' is the same as in E. The paths vq,v±, . . . ,u and 
v, . . . , v n -\, v n , which have weight at least c\n by definition, are stable in both E and E ' . Thus, 
the skew on each path cannot exceed 2/£>(cin), that is, it cannot exceed 2c 2 n. It follows that the 
skew between vq and v n at time t 2 in E' is at least 

L V0 (t 2 ) — L Vn (t 2 ) = L V0 {t 2 ) — L u (t 2 ) + L v (t 2 ) — L Vn {t 2 ) + L u (t 2 ) — L v {t 2 ) 
> n- 2cin -2- 4c 2 n > re/2 - 2. 

For sufficiently large n, this value exceeds 5°°(1), since we assumed that 5°°(1) G o(D). Thus, we 
have showed that after c\n • T/(l + p) G fl(D) time since edge {vQ,v n } appeared, the algorithm has 
not yet stabilized. □ 
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